release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*' # Triggers on tags like v1.0.0, v1.2.3, etc.
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag (e.g., v1.0.0)'
        required: true
        type: string

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ${{ github.repository_owner }}/sentris

jobs:
  build-and-push:
    name: Build and Push Docker Images
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history for changelog generation

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract version from tag
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            VERSION="${GITHUB_REF#refs/tags/}"
          fi
          # Remove 'v' prefix if present for Docker tags
          VERSION_CLEAN=$(echo "$VERSION" | sed 's/^v//')
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "version_clean=$VERSION_CLEAN" >> $GITHUB_OUTPUT
          echo "Extracted version: $VERSION (clean: $VERSION_CLEAN)"

      - name: Determine if this is latest
        id: is_latest
        run: |
          # Check if this is the latest tag (highest semver)
          CURRENT_TAG="${{ steps.version.outputs.version_clean }}"
          LATEST_TAG=$(git tag -l 'v*.*.*' | sort -V | tail -1 | sed 's/^v//')

          if [ "$CURRENT_TAG" = "$LATEST_TAG" ]; then
            echo "is_latest=true" >> $GITHUB_OUTPUT
            echo "This is the latest release"
          else
            echo "is_latest=false" >> $GITHUB_OUTPUT
            echo "This is not the latest release (latest: $LATEST_TAG)"
          fi

      - name: Get Git SHA
        id: git_sha
        run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Prepare image tags
        id: tags
        run: |
          # Convert repository owner to lowercase for Docker registry compatibility
          IMAGE_PREFIX_LOWER=$(echo "${{ env.IMAGE_PREFIX }}" | tr '[:upper:]' '[:lower:]')
          VERSION_TAG="${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-backend:${{ steps.version.outputs.version_clean }}"

          if [ "${{ steps.is_latest.outputs.is_latest }}" = "true" ]; then
            echo "backend_tags<<EOF" >> $GITHUB_OUTPUT
            echo "$VERSION_TAG" >> $GITHUB_OUTPUT
            echo "${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-backend:latest" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
            
            echo "worker_tags<<EOF" >> $GITHUB_OUTPUT
            echo "${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-worker:${{ steps.version.outputs.version_clean }}" >> $GITHUB_OUTPUT
            echo "${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-worker:latest" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
            
            echo "frontend_tags<<EOF" >> $GITHUB_OUTPUT
            echo "${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-frontend:${{ steps.version.outputs.version_clean }}" >> $GITHUB_OUTPUT
            echo "${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-frontend:latest" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
          else
            echo "backend_tags<<EOF" >> $GITHUB_OUTPUT
            echo "$VERSION_TAG" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
            
            echo "worker_tags<<EOF" >> $GITHUB_OUTPUT
            echo "${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-worker:${{ steps.version.outputs.version_clean }}" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
            
            echo "frontend_tags<<EOF" >> $GITHUB_OUTPUT
            echo "${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-frontend:${{ steps.version.outputs.version_clean }}" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
          fi

      - name: Build and push backend image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          target: backend
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.tags.outputs.backend_tags }}
          build-args: |
            VITE_GIT_SHA=${{ steps.git_sha.outputs.sha }}
            POSTHOG_API_KEY=${{ secrets.POSTHOG_API_KEY }}
            POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and push worker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          target: worker
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.tags.outputs.worker_tags }}
          build-args: |
            VITE_GIT_SHA=${{ steps.git_sha.outputs.sha }}
            POSTHOG_API_KEY=${{ secrets.POSTHOG_API_KEY }}
            POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and push frontend image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          target: frontend
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.tags.outputs.frontend_tags }}
          build-args: |
            VITE_GIT_SHA=${{ steps.git_sha.outputs.sha }}
            VITE_PUBLIC_POSTHOG_KEY=${{ secrets.POSTHOG_API_KEY }}
            VITE_PUBLIC_POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
            POSTHOG_API_KEY=${{ secrets.POSTHOG_API_KEY }}
            POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Generate changelog
        id: changelog
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          PREVIOUS_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")

          # Convert repository owner to lowercase for Docker registry compatibility
          IMAGE_PREFIX_LOWER=$(echo "${{ env.IMAGE_PREFIX }}" | tr '[:upper:]' '[:lower:]')

          if [ -z "$PREVIOUS_TAG" ]; then
            echo "No previous tag found, generating full changelog"
            CHANGELOG=$(git log --pretty=format:"- %s (%h)" --no-merges)
          else
            echo "Generating changelog from $PREVIOUS_TAG to $VERSION"
            CHANGELOG=$(git log ${PREVIOUS_TAG}..HEAD --pretty=format:"- %s (%h)" --no-merges)
          fi

          if [ -z "$CHANGELOG" ]; then
            CHANGELOG="No changes detected"
          fi

          {
            echo "## Release $VERSION"
            echo ""
            echo "### Docker Images"
            echo ""
            echo "- Backend: \`${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-backend:${{ steps.version.outputs.version_clean }}\`"
            echo "- Worker: \`${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-worker:${{ steps.version.outputs.version_clean }}\`"
            echo "- Frontend: \`${{ env.REGISTRY }}/${IMAGE_PREFIX_LOWER}-frontend:${{ steps.version.outputs.version_clean }}\`"
            echo ""
            echo "### Changes"
            echo ""
            echo "$CHANGELOG"
          } > CHANGELOG.md

          echo "changelog<<EOF" >> $GITHUB_OUTPUT
          cat CHANGELOG.md >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          IS_PRERELEASE="${{ contains(steps.version.outputs.version, '-') }}"
          PRERELEASE_FLAG=""
          if [ "$IS_PRERELEASE" = "true" ]; then
            PRERELEASE_FLAG="--prerelease"
          fi

          # Check if release already exists
          if gh release view "$VERSION" --repo "${{ github.repository }}" > /dev/null 2>&1; then
            echo "Release $VERSION already exists, updating..."
            gh release edit "$VERSION" \
              --repo "${{ github.repository }}" \
              --notes-file CHANGELOG.md \
              $PRERELEASE_FLAG
          else
            echo "Creating new release $VERSION..."
            gh release create "$VERSION" \
              --repo "${{ github.repository }}" \
              --title "Release $VERSION" \
              --notes-file CHANGELOG.md \
              $PRERELEASE_FLAG
          fi

      - name: Update version check service
        env:
          VERSION_CHECK_URL: ${{ secrets.VERSION_CHECK_URL }}
          VERSION_CHECK_ADMIN_SECRET: ${{ secrets.VERSION_CHECK_ADMIN_SECRET }}
        run: |
          echo "🚀 Updating version check service..."
          echo "   App: sentris"
          echo "   Version: ${{ steps.version.outputs.version_clean }}"
          echo "   Endpoint: $VERSION_CHECK_URL/api/admin/update-version"

          response=$(curl -s --connect-timeout 10 --max-time 30 -w "\n%{http_code}" -X POST "$VERSION_CHECK_URL/api/admin/update-version" \
            -H "Authorization: Bearer $VERSION_CHECK_ADMIN_SECRET" \
            -H "Content-Type: application/json" \
            -d "{\"app\":\"sentris\",\"version\":\"${{ steps.version.outputs.version_clean }}\"}")

          http_code=$(echo "$response" | tail -n1)
          body=$(echo "$response" | head -n-1)

          echo "Response: $body"

          if [ "$http_code" -eq 200 ]; then
            echo "✅ Version check service updated successfully!"
          else
            echo "❌ Failed to update version check service (HTTP $http_code)"
            echo "Response: $body"
            exit 1
          fi

      - name: Verify version update
        env:
          VERSION_CHECK_URL: ${{ secrets.VERSION_CHECK_URL }}
        run: |
          echo "🔍 Verifying version update..."

          # Wait a moment for cache to update
          sleep 2

          # Check if the version was updated
          response=$(curl -s --connect-timeout 10 --max-time 30 "$VERSION_CHECK_URL/api/version/check?app=sentris&version=0.0.1")
          latest_version=$(echo "$response" | jq -r '.latest_version')

          echo "Latest version returned by API: $latest_version"
          echo "Expected version: ${{ steps.version.outputs.version_clean }}"

          if [ "$latest_version" = "${{ steps.version.outputs.version_clean }}" ]; then
            echo "✅ Verification successful! Version check service is returning the correct version."
          else
            echo "⚠️ Warning: API returned different version than expected"
            echo "   This might be expected if GitHub release fetching is enabled"
          fi

      - name: Bump package.json version via PR
        if: steps.is_latest.outputs.is_latest == 'true'
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION_CLEAN="${{ steps.version.outputs.version_clean }}"
          RUN_ID="${{ github.run_id }}"
          BRANCH="chore/bump-version-${VERSION_CLEAN}-${RUN_ID}"
          echo "Bumping root package.json version to ${VERSION_CLEAN}..."

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          git fetch origin main

          # Clean up any existing bump branch for this version
          git push origin --delete "chore/bump-version-${VERSION_CLEAN}" 2>/dev/null || true

          git checkout -b "$BRANCH" origin/main

          # Update the root package.json version
          jq --arg v "$VERSION_CLEAN" '.version = $v' package.json > package.json.tmp && mv package.json.tmp package.json

          # Only create PR if there's actually a change
          if git diff --quiet package.json; then
            echo "package.json already at version ${VERSION_CLEAN}, skipping."
          else
            git add package.json
            git commit -m "chore: bump version to ${VERSION_CLEAN} [skip ci]"
            git push origin "$BRANCH"

            # Create PR and enable auto-merge
            PR_URL=$(gh pr create \
              --title "chore: bump version to ${VERSION_CLEAN}" \
              --body "Automated version bump from release workflow (${VERSION_CLEAN})." \
              --base main \
              --head "$BRANCH")

            echo "✅ Created PR: $PR_URL"

            # Attempt to enable auto-merge (requires repo setting enabled)
            gh pr merge "$PR_URL" --auto --squash 2>/dev/null \
              && echo "✅ Auto-merge enabled" \
              || echo "⚠️  Auto-merge not available — merge the PR manually"
          fi

      - name: Release summary
        run: |
          echo "📋 Release Summary:"
          echo "   ✅ Docker images built and pushed"
          echo "   ✅ GitHub Release created: ${{ steps.version.outputs.version }}"
          echo "   ✅ Version check service updated"
          if [ "${{ steps.is_latest.outputs.is_latest }}" = "true" ]; then
            echo "   ✅ package.json version bump PR created"
          else
            echo "   ⏭️  package.json NOT updated (not the latest version)"
          fi
          echo ""
          echo "🎉 Users will now receive update notifications for version ${{ steps.version.outputs.version_clean }}"